Hi,
I've got this report while booting v5.10.13 kernel, but upstream code
seems to be the same.
The access to port_status, the code is:
struct ehci_regs {
u32 port_status[0]; /* up to N_PORTS */
u32 reserved3[9];
https://elixir.bootlin.com/linux/v5.12-rc7/source/include/linux/usb/ehci_def.h#L130
Question: should it be an empty array "[]" to prevent the undefined behavior?
Or should it be declared as "[9]" to be more explicit?
UBSAN: array-index-out-of-bounds in drivers/usb/host/ehci-hub.c:893:16
index 1 is out of range for type 'u32 [0]'
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.10.13+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.13.0-44-g88ab0c15525c-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x183/0x225 lib/dump_stack.c:118
ubsan_epilogue lib/ubsan.c:148 [inline]
__ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:356
ehci_hub_control+0x1d27/0x2370 drivers/usb/host/ehci-hub.c:893
rh_call_control+0x938/0x11a0 drivers/usb/core/hcd.c:683
rh_urb_enqueue drivers/usb/core/hcd.c:842 [inline]
usb_hcd_submit_urb+0x2f2/0x5f0 drivers/usb/core/hcd.c:1543
usb_start_wait_urb+0x11a/0x550 drivers/usb/core/message.c:58
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x281/0x470 drivers/usb/core/message.c:153
hub_power_on+0x1a8/0x3c0 arch/x86/include/asm/bitops.h:219
hub_activate+0x330/0x1ba0 drivers/usb/core/hub.c:1076
hub_configure+0x19e0/0x2690 drivers/usb/core/hub.c:1680
hub_probe+0x82f/0x9b0 drivers/usb/core/hub.c:1882
usb_probe_interface+0x67b/0xb70 drivers/usb/core/driver.c:396
really_probe+0x58b/0x1580 drivers/base/dd.c:558
driver_probe_device+0x15a/0x310 drivers/base/dd.c:740
bus_for_each_drv+0x16a/0x1f0 drivers/base/bus.c:431
__device_attach+0x2b2/0x4b0 drivers/base/dd.c:914
bus_probe_device+0xb8/0x200 drivers/base/bus.c:491
device_add+0x8e7/0xcb0 drivers/base/core.c:2954
usb_set_configuration+0x1b98/0x2230 drivers/usb/core/message.c:2159
usb_generic_driver_probe+0x83/0x140 drivers/usb/core/generic.c:238
usb_probe_device+0x13a/0x260 drivers/usb/core/driver.c:293
really_probe+0x58b/0x1580 drivers/base/dd.c:558
driver_probe_device+0x15a/0x310 drivers/base/dd.c:740
bus_for_each_drv+0x16a/0x1f0 drivers/base/bus.c:431
__device_attach+0x2b2/0x4b0 drivers/base/dd.c:914
bus_probe_device+0xb8/0x200 drivers/base/bus.c:491
device_add+0x8e7/0xcb0 drivers/base/core.c:2954
usb_new_device+0xa43/0x1120 drivers/usb/core/hub.c:2554
register_root_hub+0x214/0x560 drivers/usb/core/hcd.c:1009
usb_add_hcd+0x8ee/0x1080 drivers/usb/core/hcd.c:2793
usb_hcd_pci_probe+0xa61/0x1280 drivers/usb/core/hcd-pci.c:264
local_pci_probe drivers/pci/pci-driver.c:308 [inline]
pci_call_probe drivers/pci/pci-driver.c:365 [inline]
__pci_device_probe drivers/pci/pci-driver.c:390 [inline]
pci_device_probe+0x3ef/0x630 drivers/pci/pci-driver.c:433
really_probe+0x544/0x1580 drivers/base/dd.c:554
driver_probe_device+0x15a/0x310 drivers/base/dd.c:740
device_driver_attach+0x176/0x280 drivers/base/dd.c:1015
__driver_attach+0xa7/0x490 drivers/base/dd.c:1092
bus_for_each_dev+0x168/0x1d0 drivers/base/bus.c:305
bus_add_driver+0x324/0x5e0 drivers/base/bus.c:622
driver_register+0x2e9/0x3e0 drivers/base/driver.c:171
do_one_initcall+0x1a3/0x410 init/main.c:1217
do_initcall_level+0x168/0x218 init/main.c:1290
do_initcalls+0x50/0x91 init/main.c:1306
kernel_init_freeable+0x33b/0x47f init/main.c:1527
kernel_init+0xd/0x290 init/main.c:1415
